1. Who is responsible for your data?
The Gestiway service is provided by Gestiway SAS (à compléter), Adresse du siège à compléter. Depending on the data involved, we act in two distinct capacities:
- Data Processor for user account data of our clients (name, email, login logs), subscription management, and support.
- Subprocessor (Article 28 of the GDPR) for data entered by our professional clients in their space: their prospects and customers, events, quotes, contracts, invoices, emails, and reviews. Each service provider is then responsible for processing; we act solely upon their instructions, within the framework of the data processing agreement.
Are you a client of a photographer, a DJ, or another service provider using Gestiway? Please contact this service provider directly for access or data deletion requests: they are responsible for processing your data. We assist them in responding.
Contact pour toute question relative à vos données : dpo@gestiway.example.
2. Data we process as a data processor
- Account: name, email address, password (stored only as bcrypt hash), two-factor authentication secret (encrypted), role and linked spaces.
- Customer company: legal name, SIREN, address, VAT number, subscribed plan, and subscription history.
- Subscription payment: processed via Stripe; we neither receive nor store any bank card numbers.
- Security: login and sensitive action logs (date, IP address, browser), failed login attempts.
- Exchanges: messages sent to support.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, provide the service | Execution of the contract (Art. 6.1.b GDPR) |
| Invoice the subscription, manage accounting | Legal obligation (art. 6.1.c) and contract execution |
| Secure the service, prevent fraud and abuse (logs, limitation of attempts) | Legitimate interest (art. 6.1.f) to protect the service and your data |
| Respond to your support requests | Execution of the contract |
| Measure visits and clicks on the storefront with Google Analytics 4 | Consent (Art. 6.1.a), revocable at any time |
| Informing you of important updates to the service and its conditions | Execution of the contract and legitimate interest |
We do not use your data for targeted advertising or profiling, and we never sell your data.
4. Retention periods
| Data | Duration |
|---|---|
| User account | During the contractual relationship, then deletion or anonymization at latest 3 years after the end of the relationship |
| Subscription invoices and accounting documents | 10 years (Article L123-22 of the Commercial Code) |
| Login and audit logs | 12-month rolling period |
| Login session | Maximum of 30 days |
| Password reset and verification links | 1 hour (password), 7 days (email verification) |
| Data from deleted spaces | Deleted 30 days after request; data backups erased according to their rotation cycle |
For their own clients' data, our users set their retention periods. The service defaults to automatically anonymizing inactive prospects for 36 months, in accordance with the CNIL recommendation (3 years after the last contact from the prospect).
5. Recipients and subcontractors
Your data is accessible only to authorized personnel of the provider, within the limits of their responsibilities, and to our technical subcontractors (hosting, emails, payments), listed on the Subcontractors page.
Each enterprise space is isolated at the database level: a user can never access data from another enterprise.
6. Location and transfers
Data is hosted within the European Union. When Google Analytics is accepted, Google may process navigation data outside the EU, according to the applicable guarantees described in our Cookie Policy. When a payment provider (Stripe) may access certain data from a third country, this transfer is governed by the standard contractual clauses of the European Commission or the EU–U.S. data protection framework.
7. Security
- Encryption of communications (HTTPS) and strict security headers.
- Hashed passwords (bcrypt), optional two-factor authentication, temporary lockout after multiple failed attempts.
- Isolation of each enterprise by security policies at the line level (PostgreSQL RLS).
- AES-256-GCM encryption of secrets and re-displayable links, public tokens stored only as hashes.
- Audit log of sensitive actions, regular backups.
8. Your rights
Vous disposez des droits d'accès, de rectification, d'effacement, de limitation, de portabilité et d'opposition, ainsi que du droit de définir des directives relatives au sort de vos données après votre décès.
To exercise these rights, write to dpo@gestiway.example. We respond within one month. We may request supporting evidence if there is reasonable doubt about your identity.
You can also export your data from your settings, and file a complaint with the CNIL: cnil.fr/fr/plaintes.
10. Evolution of this policy
This policy may evolve. In case of significant changes, users are notified by email or within the application.